Publish assigns the Notification a monotonic ID, stores it in the replay buffer, and fans it out to every live Subscribe channel. ID assignment and bu

doRequestWithHeaders is a thin variant of doRequest that lets a test set arbitrary request headers (e.g. Authorization) without spinning up a real aut

realPNG returns a tiny but real PNG (1x1 transparent) so image.DecodeConfig succeeds.

DeleteItem soft-deletes the item by stamping deleted_at and bumping the workspace-scoped seq so delta-sync clients see the tombstone. The seq bump use

* Open the confirmation and resolve when the user answers — the descriptor's * `ctx.confirmDelete`. A no-op that resolves false when the caller may

textOf returns the text of the first content block, or empty string. Robust to mcp-go's content-type variations (TextContent, ErrorContent).

EventsSince returns events for a workspace with IDs greater than sinceID. Used to replay missed events on SSE reconnect (Last-Event-ID). Returns nil

Publish sends an event to all subscribers for the event's workspace.

NewWorkspaceState returns a state pre-seeded with `initial`. Pass an empty string to start with no default — the first tool call will then need an exp

Unsubscribe removes a subscriber and closes its channel.

requireMinRole checks role and writes a 403 if insufficient. Returns true if the request should continue, false if it was rejected.

newCollabTestServer wires up an httptest server whose only handler upgrades the inbound WS, registers it with the manager, and waits for the session t

--- Item Grants --- CreateItemGrant creates a direct grant on an item for a user.

GetBacklinks returns the items in `workspaceID` that contain a resolved `[[...]]` reference to `targetItemID`. Phase 1 only returns ref-kind backlinks

New creates a new Metrics instance with a custom registry and registers all application metrics plus Go runtime and process collectors.

helper: fetch the dashboard and return the parsed response

oauthEnabledTestServer builds a Server with cloud mode + a real internal/oauth.Server backed by the test store. Returns the Server so each test can dr

===================================================================== Helpers ===================================================================== re

Close stops every active room AND blocks until every in-flight Join goroutine has returned. After Close, Join is undefined — callers must coordinate s

visibleCollectionIDs returns the set of collection IDs the current user can see in the given workspace. Returns nil if the user has "all" access (no f

call drives one handler with the route params it reads, exactly as the router would. Shared by every leg so a difference in invocation cannot be mista

Decode reads bytes from r and returns the decoded image plus the detected format ("png", "jpeg", "gif", "bmp", "tiff", …). The returned format is the

IsZero reports whether the collection declares no kernel traits at all.

GetUserByEmail retrieves a user by email address (case-insensitive).

bearerJSON marshals body and issues a Bearer-authenticated request. Needed for any mutation issued AFTER a real user has been created in the test's st

currentUserID returns the authenticated user's ID, or empty string.

CreateAttachment inserts an attachment row. id and created_at are generated by the store. The caller is expected to have already written the blob via

requireItemVisible checks that the item's collection is visible to the requesting user. For guests with item-level grants, also verifies that the spec

req builds a request from A to B with the standard actor.

New creates a Store backed by SQLite at the given path. The DSN is configured for safe concurrent use under Go's connection pool: - `_pragma=busy_ti

Rebind converts a query with "?" placeholders to the dialect's format. For SQLite this is a no-op. For PostgreSQL, "?" becomes "$1", "$2", etc.

createTaskWithFields is a small helper for the field-patch/OCC tests: POST a task with the given fields JSON and return the created item.

runItemCopy is the whole command, minus flag binding. Order of operations is load-bearing: 1. Build the request (the SAME body both endpoints take).

testServerWithCollab wires a RoomManager onto a fresh test server so the collab handler answers 200/101 on the happy path. Tests that only assert on a

SetObserver attaches an Observer. Passing nil detaches. Safe to call after the bus is running; cmd/pad/cmd_server.go calls it at wiring time.

ImportWorkspace imports a workspace from an exported data structure. It creates a new workspace with regenerated IDs, remapping all references. If new

auditMeta safely marshals a map to a JSON string for audit log metadata. Falls back to "{}" on marshal error so audit calls never break.

Exported context-key helpers for callers that need to synthesize an authenticated request without going through the auth middleware chain (e.g. the in

guestResourceFilter returns the full-collection IDs and granted item IDs for the current user if they need item-level grant filtering. Returns nil/nil

Set adds or replaces the credential for the given server URL. The canonical URL is mirrored into the value's ServerURL field so a caller reading the c

isCollectionVisible checks if a collection ID is in the visible set. If visibleIDs is nil, all collections are visible.

Build returns a cmdhelp Document without serializing it. Callers that need to inspect or further mutate the document (tests, dynamic enum resolvers in

EventsSince returns buffered notifications with ID > sinceID, for Last-Event-ID resume. Returns nil if sinceID has been evicted from the buffer (gap t

ExportWorkspace exports all data for a workspace into a portable format. It reads the POOL, so each of its sections takes its own snapshot and a conc

s256Challenge computes the base64url(no-padding, SHA256(verifier)) per RFC 7636 §4.2. PKCE clients use this to derive code_challenge from code_verifie

GetAttachment returns the attachment with the given id, or (nil, nil) if no such row exists. Soft-deleted rows ARE returned (so download handlers can

ValidateUpload combines the sniff result, the client-supplied MIME header, and the filename's extension to produce one of: - (entry, "", nil) — accep

liveCmdhelpDoc returns a minimal cmdhelp.Document with every command path the read-only catalog references. Lighter than re-running pad's full cobra e

workspaceIDForSlug looks up the internal UUID for a slug — used by tests that synthesize attachment rows directly via the store (bypassing the upload

--- Item Links ---

ItemRef returns the reference string (e.g. "TASK-5") for an item, or empty string.

SeedCollectionsFromTemplate seeds the workspace with collections from the named template. An empty template name materializes the default collections

captureStdout runs fn with os.Stdout redirected and returns what it wrote. The list commands print through fmt/os.Stdout rather than cmd.OutOrStdout,

readCSRFFromCookie hits any consent-rendering endpoint that sets the CSRF cookie on first visit, returns the token. We use oauth/authorize because it'

refOf builds a PREFIX-NUMBER string from a fresh item — used by the integration tests since the canonical ref isn't on the model directly. ItemNumber

resolvableBody is a request the copy can actually satisfy: the two needs_value entries the base fixture leaves open are supplied, so the preflight com

BUG-2301: `pad item note` / `pad item decide` wrote structured entries that no web surface rendered — the renderer shipped in c61f4cda and was deleted

New creates a MemoryBus with the default replay buffer size.

Remove deregisters a session. It must be idempotent and must not panic on an unknown id — the stream handler calls it from a defer that also runs on p

--- Phase Links --- SetParentLink sets the parent for an item. Since an item can belong to at most one parent, this deletes any existing parent link f

GetWorkspaceMember retrieves a single membership record.